Privacy Policy

1. About This Policy and the Platform

Collaro is an online marketplace that helps dog owners (“Owners”) discover and book independent care providers (“Providers”). We provide the technology that connects Owners and Providers; we do not provide dog-care services ourselves and we do not employ Providers.

This Policy applies to all users of the Platform — Owners, Providers and administrators — and to visitors to our website, and covers information we process through the mobile application, our website at collaro.app, our application programming interfaces (APIs) and related communications such as email and push notifications.

Capitalised terms that are not defined in this Policy have the meaning given to them in our Terms of Service.

Who is responsible for your information. The controller of your personal information — the person who decides why and how it is processed — is Ofek Levi, an individual who operates Collaro in Israel. You can contact the controller at contact@collaro.app or by post at Israel, Rosh HaAyin, Yoram Hatuka 36 (see “Contact Us”).

2. Information We Collect

We collect the information described below so that the Platform can function, so that Owners and Providers can find and trust one another, and so that bookings can be arranged and managed.

• Account information: your name, your email address, the role you choose (Owner or Provider), your preferred language, your email-verification status, your notification preference, an optional profile photo, the version of the Terms of Service and this Policy that you accepted and, if you declined an updated version, which version you declined and when. If you register with an email and password, we store your password only as a one-way cryptographic hash (bcrypt); we never store it in readable form.
• Google sign-in information: if you continue with Google, we receive a Google account identifier, your name, your email address and a link to your Google profile picture. When this creates a new account, we store the identifier, that name and email address, and the picture link (the picture remains hosted by Google and is not copied to our storage; it is used as your profile photo unless you upload your own). If an account with the same email address already exists, continuing with Google signs you in to that account and connects your Google account to it: we store the Google identifier, mark your email address as verified and, if the account has no profile photo, use your Google picture; we do not change the account’s name. If that account’s email address had never been verified, we also disable its existing password, sign it out on all devices, remove its push-notification registrations and ask for the Terms of Service and this Policy to be accepted again. We do not receive your Google password. A new account is created when you first continue with Google, before you choose your role and accept the Terms of Service and this Policy.
• Sign in with Apple information: if you continue with Apple, we receive and store an identifier that Apple creates for Collaro and the email address Apple shares with us. If you use Apple’s Hide My Email option, that address is a private relay address created by Apple: our emails to it are delivered through Apple’s private email relay service to your personal address, and we do not see your personal address. The first time you sign in, you can choose to share your name with us; when we create your account, we use it as your name (if you do not share a name, we use the part of your email address before the “@”, or a generic name if you use Hide My Email; you can change your name in the app). Apple does not provide a profile picture, and we do not receive your Apple ID password. If no account exists for the email address Apple shares with us, an account is created when you first continue with Apple, before you choose your role and accept the Terms of Service and this Policy; a Hide My Email address (or any address other than the one on an account you already have) does not match that account, so a separate account is created. If an account with the same email address already exists, we connect Sign in with Apple to it only after you enter a one-time code we send to that address, and we then email that address a notice that Sign in with Apple was connected; if that account’s email address had never been verified, connecting Apple also disables its existing password, signs it out on all devices, removes its push-notification registrations and asks for the Terms of Service and this Policy to be accepted again.
• Email-verification, password-reset, account-restoration and Sign in with Apple connection codes: we generate a one-time code (for a password reset, a one-time code and then a one-time token) and store only a hashed version of it, which is deleted once it is used or replaced, or automatically after it expires 10 minutes after it is issued. The code itself is sent to your email address, so a copy remains in your mailbox and, for a limited period, with our email-delivery provider (see “Third-Party Services”).
• Provider profile information (Providers only): your public display name (if you do not set one, your account name is shown instead), whether you offer your services as a business or as a private individual, a phone number, a postal address (street, city and country), a precise map location (geographic coordinates) for your service point and the time zone and general area (region) derived from it, a written biography, and an optional image gallery. For each service you offer, we also store its type, description, capacity, availability schedule and prices, and we calculate a relative price level for your profile and services by comparing your prices with those of other Providers in the same city. Your account name — not only your display name — is shown to Owners you have a booking or booking request with (see “How Information Is Shared and What Other Users See”).
• Dog information (Owners): for each dog you add — its name, breed, age, size, gender, optional free-text notes, whether you declare it vaccinated and healthy, and, where it is not, free-text medical notes. You may also add a photo of each dog. Medical and health notes are sensitive information; see “Sensitive Information”.
• Identity-verification data (Providers): if you choose to use the verification feature, you submit an image of a government-issued identification document and a selfie. The whole image of the document is sent without cropping (the app only converts it on your device into a JPEG copy, which may be smaller), so it includes everything printed on the document — such as your name, ID number, date of birth and photo and, on some documents, your address — and anything else visible in the picture. These images are sent through our servers to our AI provider (OpenAI) for an automated check, which includes comparing the face in your selfie with the photo on the document. We do not save them on our servers or with our image host; OpenAI may keep them for a limited period under its own terms, and temporary copies may remain on your device (see “How and Why We Use Identity Verification”). We keep a verification record for every Provider account — created as “not verified” when you first open a screen that shows your verification status — and, once you submit, the result of your latest check (approved or rejected), the reasons for any rejection and the time of the check.
• Booking information: the bookings you create or receive — including requests that were declined, expired or cancelled — with the selected service, the booking’s dates and times and the time zone in which they are scheduled, the dogs involved (with a copy of each dog’s profile as it was when the request was sent), any notes the Owner writes for the Provider, the price and how it was calculated, the parties, the booking status, and the booking’s history — including any cancellation requests (with the reason given, if any) and the recording and confirmation of the direct payment.
• Messages and support requests: the content and metadata (sender, timestamps, read status) of messages you exchange with another user or with our support team through the in-app chat, and the messages you send us through the Contact us form in the app, together with the reason you choose and your name, email address, role, account identifier and whether your account is currently blocked, which are included so that we can reply to you. Contact us messages are not stored in our database: they reach us, and are kept, as emails in our support mailbox.
• Reviews and ratings: the star ratings and written reviews you submit about a Provider, and the reviews submitted about you as a Provider.
• Reports: if you report a Provider, the reason you select, your written description and any evidence photographs you attach, together with the booking the report relates to and the names of the Provider and the service at the time of the report. When we handle a report, we also record its status, who handled it and when, and any internal notes our administrators add.
• Device and technical information: a per-installation device identifier generated on your device; push-notification tokens for your devices; the version of the app, which your device sends to our servers with each request so that we can tell you about updates and, when a version is no longer supported, ask you to update the app before you continue using it; for each device you sign in on, a sign-in record holding the device identifier, when you first signed in on that device, when its sign-in was last renewed, when it expires and whether it was signed out, with only a hashed form of the token that keeps you signed in (we do not store your IP address or device model with these records); and app settings such as your chosen language and display theme (the theme is stored only on your device). A sign-in record and your notification preference (on or off, depending on whether you allow notifications on your device after you first sign in) — and, if you allow notifications, your device’s push token — are stored from your first sign-in, including when you continue with Google or Apple before choosing a role and accepting the Terms of Service and this Policy. When your device connects to our servers, they also process its IP address (see “How We Protect Your Information”).
• Location information: a Provider’s chosen service coordinates (stored as part of the provider profile). If a Provider uses their device’s current location, or taps the map, when setting a service address, those coordinates are sent through our servers to our geocoding provider to look up the address; text you type into an address field or the map’s search box is sent the same way. For Owners, if you allow location access, your device’s current location is read when the map opens and is sent to our servers to show nearby Providers; it is not saved in our database. See “Location Information”.
• Moderation information: if we block a Provider account, we keep a record of the block, when it was made, which administrator made it and the reason given; the reason is also kept in our internal audit record, including after the block is lifted.

You are not under any legal obligation to give us any of this information: providing it depends on your choice and your consent. Some of it is, however, needed to use the Platform: without an email address (and, if you register with an email address and password, your name and a password) you cannot create an account; to add a dog you must give its name, breed, age, size and gender, and if you mark it as not vaccinated and healthy you must describe its condition; you cannot send a booking request without adding at least one dog; without a phone number, street address, service location, biography, the choice of business or private provider and at least one active service you cannot be listed as a Provider; without location access the map opens at a default area rather than near you; without notification permission (or with notifications switched off in Settings) you do not receive push notifications, so booking requests, chat messages and most other updates reach you only in the app, although we still email you one-time codes, booking-completed notices, support messages and notices about your account; and without submitting identity-verification images you cannot receive the “Verified” badge or appear in lists of Providers filtered to show only verified Providers. Optional details — such as a profile photo, a gallery, a dog’s notes or booking notes — can be left out without losing access to the Platform.

3. How and Why We Use Your Information

We use your information for the following purposes, all connected with operating the Platform:

• create and manage your account and authenticate you when you sign in;
• display Owner and Provider profiles, dog profiles, services, prices, reviews and ratings to the relevant users;
• show Providers on the map and in the public lists of Providers in the app and on our website, calculate their distance from the map’s centre, determine each Provider’s general area from their service location, calculate a relative price level for each Provider and service by comparing its prices with those of other Providers in the same city, and let Owners and visitors who are not signed in search for and filter Providers, including by area and by verification status;
• enable the booking workflow, including requests, acceptance or rejection, cancellations, the recording and confirmation of direct payments, and automatic completion;
• enable in-app messaging between an Owner and a Provider who have an accepted booking together, and between you and our support team, and respond to messages you send us through the Contact us form;
• operate the identity-verification feature, the “Verified” badge and the option to show only verified Providers;
• send you service-related communications — verification and account codes, booking-completed notices, notices about your account, and support replies by email, and booking, payment-confirmation, review and chat updates by push notification (if enabled) — see “Notifications and Communications”;
• operate ratings and reviews, which are shown publicly, can be used to filter search results, and determine the order of lists of Providers that are not sorted by distance (for example, when browsing without a location or searching by name);
• maintain the safety, security and integrity of the Platform, moderate reports (our administrators are alerted when a report is filed), prevent and investigate fraud and abuse, and enforce our Terms of Service;
• keep an internal audit record of booking, payment-confirmation, service and moderation events, of account deactivation, restoration and Sign in with Apple connection, and of your decisions to decline, or later accept, an updated version of the Terms of Service and this Policy, for accounting, security and record-keeping purposes; and
• comply with applicable legal obligations and respond to lawful requests.

4. Sensitive Information

Some information you provide is sensitive, and we want to be clear about how it is handled.

• Dog health and medical notes: if you mark a dog as not healthy, you must describe its condition. These free-text health notes, together with the rest of the dog’s profile, are disclosed to a Provider when you send that Provider a booking request — that is, before the Provider accepts. A Provider you request will therefore see this information even if they later decline or do not respond. The booking keeps a copy of the dog’s profile as it was when you sent the request, and that copy remains visible to the Provider as part of the booking record, even if you later edit or delete the dog. If you deactivate your account, the dog’s name, notes, medical notes and photo are no longer shown to the Provider in the app, but its breed, age, size, gender and declared health status remain visible, and a photo link the Provider already received may keep working (see “Account Deletion and Data Retention”). Only include details you are comfortable sharing with the Provider you are requesting. These notes are about your dog: please do not include sensitive information about yourself or other people in them, or in other free-text fields, messages, reviews or reports.
• Identity documents and biometric data: the ID image and selfie you submit to the verification feature are sent to our AI provider (OpenAI), which analyses them to check the document and compares the face in your selfie with the photo on the document. This automated facial comparison is performed solely to compute the result of the check. Because the selfie is compared by computer with the photo on the document to verify your identity, we treat these images as information of special sensitivity (a biometric identifier) under Israeli privacy law. We do not save the images on our servers or with our image host, and they are never shown to other users. Under OpenAI’s published API data policies they are not used to train its models, but OpenAI may retain them for up to 30 days for abuse monitoring, or longer where the law requires it or to protect against harm — see “How and Why We Use Identity Verification”.

5. How and Why We Use Identity Verification

Identity verification is an optional feature that lets a Provider display a “Verified” badge. You are never required to verify your identity to browse or use the Platform. If you choose not to, your profile does not show the badge, and it is left out of the list of Providers when someone browsing that list in the app or on our website chooses to see only verified Providers.

If you choose to use it, you submit an image of a government-issued identification document (a national ID card, passport or driver’s licence), which you can take with your camera or choose from your photo library, together with a selfie, which must be taken with your camera. Before sending them, the app re-encodes both images on your device as JPEG files, removing embedded metadata such as location; it does not crop, blur or hide any part of the document, so the details printed on it are sent with it. Our server forwards them to OpenAI, applies a fixed rule to OpenAI’s answer and returns a decision. Tapping “Submit for Verification”, after the notice shown on that screen, is your consent to this processing. We want to be transparent about what this feature is and is not:

• The check is fully automated and is performed by our AI provider (OpenAI), whose model receives the two images and a fixed set of instructions — your name, email address and account identifier are not sent with them. It assesses whether the document appears to be a national ID, passport or driver’s licence and is readable, whether the selfie is a clear photo of exactly one real person, and whether the selfie appears to show a different person from the photo on the document — a deliberately lenient comparison that fails only when the two clearly cannot be the same person. The badge is granted only when none of these checks fails. Our server receives back only the answers to these checks — which kind of document the image appears to be (a national ID, passport, driver’s licence or none of these) and a yes or no for each of the other checks — not a description of the images, the details printed on the document or any measurement of your face. The comparison of the faces is made by OpenAI’s general-purpose AI model looking at the two images; our systems do not create, receive or store a facial template or any other biometric measurement.
• It is NOT a full KYC process, a government-database check, a document-authenticity or anti-forgery check, or a “liveness”/anti-spoofing check; it does not compare the name on the document with the name on your profile; and no one at Collaro reviews the images or the decision. It can make mistakes in both directions. The “Verified” badge means our automated checks passed — not that we have independently confirmed your legal identity.
• What happens to the images: your ID image and selfie are sent to OpenAI, a company based in the United States, solely to perform this check; our server holds them in memory only while the check runs and does not save them to our database or our image host. A temporary technical failure can cause the same images to be sent to OpenAI more than once for a single submission. Under OpenAI’s published API data policies, OpenAI does not use them to train its models, but it may retain them for up to 30 days for abuse monitoring, or longer where the law requires it or where OpenAI considers it necessary to protect its services or others from harm, and images flagged by its automated safety systems may be kept and reviewed by authorised OpenAI personnel. On your device, the app leaves temporary copies of the images in its cache folder until your device’s system clears it or you clear the app’s storage.
• What we keep: only the result of your latest check (approved or rejected), the reasons for any rejection (for example, that the selfie appeared to show a different person from the document) and the time of the check — not the images, and not any measurement of your face. Before your first submission, your account’s verification record simply says “not verified”. Only your verification status (verified or not) is visible to others: the badge appears on your public profile, including to people who are not signed in and on our website.
• We use this data only to operate the verification feature — to show the badge and to let anyone browsing the list of Providers choose to see only verified Providers. We do not sell or rent it, and we do not use it for advertising or profiling.
• Once your check has passed, the badge stays on your profile and is not checked again, even if your name or photos later change; if your check was rejected, you can try again. There is currently no way to remove the badge yourself in the app: you can ask us at contact@collaro.app to correct a result you believe is wrong, or to delete your verification record and remove the badge, which withdraws your consent to this processing (images already sent to OpenAI cannot be recalled). The verification record is otherwise kept while your account exists — including while your account is deactivated, so that the account can be restored — and is deleted when we process a request from you to delete your account and personal information, as described in “Account Deletion and Data Retention”.

6. How Information Is Shared and What Other Users See

The Platform is a marketplace, so some information is shared with other users so that bookings can take place. We share information only as described below, and we never sell your personal information.

• Public Provider information: once a Provider is listed, their display name (or, if none is set, their account name), profile photo, whether they are a business or a private provider, biography, gallery images, services with their prices and price level, schedules and remaining availability, time zone, general area (region, derived from their service location), average rating and reviews, number of completed bookings, verification status and the internal identifiers of their profile and account — and also their phone number, full street address (street, city and country) and exact map location (shown on the map as a pin, together with a distance from the centre of the map being viewed) — are publicly accessible, including to people who are not signed in or do not have an account: in the app’s public list of Providers, which can be browsed without signing in; through our public interfaces, which return this information, including exact map coordinates, to any device that requests it; and, in part, on our website, whose public list of Providers shows the name, photos, whether the Provider is a business or a private provider, price level, rating, number of completed bookings, verification status and general area. A Provider’s services, availability and reviews can also be retrieved through our public interfaces by anyone who has the Provider’s identifier, even while the profile is not listed. Because this information is public, anyone — including automated tools — can view, copy or collect it, also for many Providers at once (a single search through our public interfaces returns many Providers, with their exact map locations), and we cannot control what they do with it once collected. Of this information, the phone number, street address, map location, biography and the choice of business or private provider must be provided before a profile can be listed; the display name, profile photo and gallery are optional. Each Provider decides what to enter — for example, whether the address and pin are those of their home or of another place where they provide their services. A Provider’s email address, password, identity-verification images and any other account details not listed above are private: they are not part of the public profile and are not returned by our public interfaces (see “Information not shown to other users”). Providers should bear this in mind when choosing the address and location pin they publish. A Provider’s profile is public only while it is complete and at least one of its services is active: to withdraw it from public view without deactivating your account, pause (disable) all your services — your profile, phone number, address, map pin, services and availability then no longer appear in the public lists or through our public interfaces (reviews about you remain retrievable by anyone who has your identifier).
• Reviews: reviews and ratings are public and are attributed to the Owner who wrote them, including that Owner’s name and profile photo (for an account created with Google, the name and picture from Google; for an account created with Apple, the name set from your Sign in with Apple information) and an internal account identifier. If the Owner later deactivates their account or has it deleted at their request, the review stays public but is attributed to a generic user shown in the app as “Deleted user”. It still carries the same internal identifier, however, so that Owner’s reviews can be linked to one another; and because the address of a profile photo on our image host is derived from that identifier and the photo is kept while the account is deactivated, someone with technical knowledge may be able to find it.
• Information shared with your booking counterpart: when an Owner sends a booking request, the Owner’s name and profile photo, any notes written for the Provider, and the selected dogs’ full profiles (including any health and medical notes) are shared with that Provider. Within a booking, in its chat and in the notifications and emails about it, both parties are identified by their account names and profile photos — so an Owner sees a Provider’s account name even if the Provider uses a different public display name. Once the booking is accepted, the parties can exchange messages in the app. A reason given with a cancellation request is shown to the other party, and the booking summary for a booking shows both parties’ names and the names of the dogs. Providers can also see a list of their paid bookings and export a yearly spreadsheet showing, for each, the Owner’s name, the service, the dates and the amount; once exported, that file is under the Provider’s control.
• Information visible to administrators: our administrators can search Owner and Provider accounts by name or email address and see their name, email address, role and profile photo; reports, including the booking and service they concern, the name, email address and photo of the Owner who filed the report and of the Provider it concerns (including after an account is deactivated), and internal moderation notes; Providers’ block details; and our internal audit record of booking- and account-related events, in order to operate the Platform and moderate reports. Administrators are alerted by push notification when a report is filed. Messages you send through the Contact us form reach our support team by email. Our administrator tools do not give access to messages exchanged between Owners and Providers: administrators can see only messages in support conversations they take part in, and in such a conversation you see the administrator’s name and profile photo. Messages are stored on our servers in readable form; they are not end-to-end encrypted.
• Information not shown to other users: your password, your email address (although, if your name was set from the part of your email address before the “@”, that part is shown as your name until you change it), your identity-verification images (which are not stored by us), your IP address and an Owner’s device location. Our servers remove the location and other embedded metadata from the photos you upload before they are stored, although photos uploaded with an earlier version of the Platform may still contain it (see “How Uploaded Images Are Handled”).
• Service providers: we use the third parties listed under “Third-Party Services” to host our servers and data, store and deliver images, send email and push notifications, provide maps and geocoding, and perform the automated identity-verification check. Most of them process information on our behalf under their terms of service and data-processing terms; some are public services that receive information under their own policies, without a separate agreement with us — Photon, Nominatim and unpkg (see “Third-Party Services”).
• Legal and safety disclosures: we may disclose information where required by law, to enforce our Terms, or to protect the rights, property or safety of our users, the public or the Platform.

7. Payments

Payment for bookings is never processed by the Platform. The price of a booking is agreed and settled directly between the Owner and the Provider — for example by bank transfer, a payment app or cash, in accordance with the law — according to their own arrangement. The Platform does not process, hold, transfer or collect any of that money and stores no payment instrument for it; it only provides a confirmation in which the Owner records that the payment was made and the Provider confirms it, or in which the Provider, who receives the payment, marks the booking as paid directly (or, if the Provider’s account has been closed, the Owner records it alone). That confirmation is a record only, reflects only what the parties marked in the app, and does not move any money.

No payments are made through the Platform: no payment card can be entered or saved in the app, and we do not collect any payment-card details.

8. Third-Party Services

We rely on the third-party services below to operate the Platform. Where they process information on our behalf, they do so to provide their service to us; where they act independently (for example, Google and Apple when you sign in with them, the app stores, or public services used under their own terms), their own processing is governed by their respective privacy policies.

• Render — hosts our servers, including our application programming interface and real-time messaging, and stores our servers’ operational logs for a limited period set by its log-retention settings. These logs can include account, booking and conversation identifiers; the times your app connects to and disconnects from our real-time service; the recipient address and subject of emails we send (for a Contact us message, the subject includes your name and the reason you chose); and, when an error occurs, technical details of it — for example, the text of an address or map search, the coordinates being looked up, or a push-delivery error that can include a device’s push token. Render may also keep its own technical records of requests to our servers, which can include your device’s IP address and the address of the request.
• Website hosting — our website at collaro.app (including the public list of Providers and the legal documents) is hosted and delivered by Cloudflare (until our move to Cloudflare is complete, it may instead be served by GitHub Pages, a service of GitHub, Inc.); the hosting service receives the IP address and technical details of the requests of people who visit it. When you view the public list of Providers, your browser also requests the list from our servers (hosted by Render) and loads the Providers’ photos from Cloudinary — or, for a Provider whose profile photo is their Google picture, from Google — so these services also receive your IP address.
• Database and data-store hosting — our MongoDB database, which holds the Platform’s data (such as accounts, profiles, dogs, services, bookings, messages, reviews and reports), and a Redis data store, which holds short-lived operational data — rate-limiting counters (which can contain your IP address, account identifier or email address), address and place lookups (the text searched or the point looked up, and the result) cached for five minutes, and similar technical data — and relays real-time updates, such as new chat messages, between our servers, are hosted by cloud service providers. Copies of data may remain in these providers’ backups for a limited period.
• Cloudinary — stores uploaded images (profile photos, dog photos, provider galleries and report evidence) and delivers them through its content-delivery network: your device or browser loads these images directly from Cloudinary, which therefore receives your IP address and technical details of the request. Uploaded images are served from links that are not individually access-restricted, which means anyone who has an image’s link can view that image. Identity-verification images are NOT uploaded to Cloudinary (see “How and Why We Use Identity Verification”).
• OpenAI — used only for the optional identity-verification feature: when a Provider submits an ID image and a selfie, our servers send those images to OpenAI, a company based in the United States, to perform the automated check. Under OpenAI’s published API data policies, they are not used to train its models and may be retained by OpenAI for up to 30 days for abuse monitoring, or longer where the law requires it or to protect against harm (see “How and Why We Use Identity Verification”).
• Google — used to authenticate you if you choose “Continue with Google” (Google confirms your identity to us and provides basic profile information: identifier, name, email and a profile-picture link; that picture is displayed to other users, and to visitors to our website, directly from Google’s servers, which therefore receive their IP address); as the operator of Google Play, which the app uses on Android to check for and install updates; and, together with Waze, as an optional external navigation app (see below).
• Apple — used to authenticate you if you choose “Continue with Apple” (Apple confirms your identity to us and provides an identifier that Apple creates for Collaro, an email address and, the first time you sign in, the name you choose to share; it does not provide a profile picture). If you use Hide My Email, that email address is a private relay address, and our emails to you are delivered through Apple’s private email relay service to your personal address.
• Waze and Google Maps — when you ask for directions to a Provider or to a dog park, the app opens one of these navigation apps (or its website) on your device and passes the destination coordinates to it; your use of that app is then governed by that app’s own privacy policy.
• Resend (email delivery) — used to send verification and account codes, booking-completed notices, account notices and support messages, to deliver the messages you send through the Contact us form to our support inbox, and to deliver the messages you send in a support conversation, by email, to the member of our support team handling it. Resend keeps the emails it sends, including their content, for a limited period under its own retention settings.
• Email routing — emails sent to our collaro.app addresses are received through Cloudflare’s email-routing service and forwarded to the mailbox where we handle support, which is hosted by an email service provider; messages sent through the Contact us form are delivered to the same mailbox. These services therefore process the content of such messages and the sender’s email address.
• Expo push notification service — used to deliver push notifications to your devices. When your device registers for notifications, it contacts Expo directly to obtain a push token (sending Expo your device’s native push token, an installation identifier and the app’s identifier); our servers then send Expo the content of the notifications for your devices, together with your push token and, for most notifications, internal identifiers that let the app open the related screen.
• Photon and Nominatim (public OpenStreetMap-based geocoding services, operated by komoot and by the OpenStreetMap Foundation respectively) — used, via our servers, to turn text you type into an address field or the map’s search box (which can include the name of a Provider you are looking for) into places and coordinates, and to turn coordinates into an address (for example, when a Provider uses their current location or taps the map to set a service address). These requests are made by our servers, not your device, and we use these services under their public usage policies, without a separate agreement.
• Overpass API (an OpenStreetMap-based service) — used by our servers to periodically download the public OpenStreetMap data on dog parks in the area the Platform serves, a copy of which we keep to show dog parks on the map. No information about you, your device or your location is sent to it.
• CARTO and a public code-delivery network (unpkg) — used to display interactive maps based on OpenStreetMap data: your device fetches the mapping library from unpkg and map tiles for the area being viewed from CARTO, so these services receive your device’s IP address and technical details of the request (such as your device’s operating system) and, through the tiles requested, can see the area you are viewing.
• Apple Push Notification service and Firebase Cloud Messaging — used only to deliver push notifications to iOS and Android devices respectively; we do not use Firebase for analytics.

We do not use advertising networks, and we do not use analytics, telemetry, crash-reporting or product-tracking tools in the app or on our website. Apple and Google may, however, provide us with crash reports and basic diagnostic information about the app if you have chosen, in your device settings, to share such information with app developers.

9. How Uploaded Images Are Handled

Most images you upload — profile photos, dog photos, provider gallery images, and report evidence — are stored with our image hosting provider, Cloudinary, and are delivered from public content-delivery links. This means those images may be viewable by anyone who has the direct link, even if the surrounding content is not otherwise public. The address of your profile photo is derived from your internal account identifier. Identity-verification images are the exception: they are never uploaded to our image host (see “How and Why We Use Identity Verification”).

Before an image you upload is stored, our servers remove its embedded metadata — including the location where it was taken (GPS coordinates), details of the camera or device, the date and time it was taken, and other data some phones attach to a photo file that can carry the location, such as the video of a “motion photo” — keeping only what is needed to display it correctly: its orientation, colour profile and transparency. The picture itself is not re-compressed, so its quality is unchanged. Only this cleaned copy is stored with our image host and shown to other users; if an image’s metadata cannot be removed (for example, because the file is damaged or in a format we do not support), the image is not accepted and you are asked to choose another. This applies to JPEG, PNG, WebP and HEIC/HEIF images, whether taken with the camera or chosen from your photo library. Images uploaded with an earlier version of the Platform were stored as they were uploaded and may still contain such metadata, including location, unless we have since removed it. Where the app allows it, you can replace or delete such an image — although, as explained below, the earlier photos of a dog that has been included in a booking request, and report evidence, are kept even then — or you can ask us at contact@collaro.app to remove it. Removing metadata does not change what the picture shows: its content (for example, a street sign or a house in the background) can still reveal where it was taken.

In the app, you can delete Provider gallery images; a profile photo or a dog’s photo can be replaced with a new one but not removed on its own (a dog’s photo is also deleted when you delete the dog, subject to the exception below), and a Google profile picture used as your photo can only be replaced. When an image is deleted or replaced, we ask our image host to delete the corresponding file and to clear it from its content-delivery caches, with two exceptions: the photos of a dog that has been included in any booking request are kept — including photos added or replaced after that request — because the booking keeps a copy of the dog’s profile, and report evidence is kept with the report. If that deletion request fails, it is not retried automatically, so the file may remain with our image host; you can ask us to remove it. Copies may also persist for a period in caches outside our control (for example, in browsers), and externally hosted images (such as a Google profile picture) are not stored or deleted by us. When you deactivate your account, your uploaded images are retained so that the account can be restored, and their links keep working (see “Account Deletion and Data Retention”).

10. Location Information

• Providers: the service location you set is stored as part of your profile at the precision you choose, is shown publicly as a map pin and used to calculate distances, is used to determine the time zone in which your services are scheduled and your bookings’ dates and times are shown, and is also used to determine your general area (region), which is shown publicly in Provider listings and on your profile and can be used to filter search results. We do not blur or approximate it, so choose your pin accordingly. If you choose to use your device’s current location, or tap the map, when setting your service address, those coordinates are sent via our servers to our geocoding provider to look up the matching address.
• Owners: the map is the Owner home screen. When it opens, the app asks for permission to use your location (unless you have already answered) and, if you allow it, reads your device’s current location in the foreground — when the map screen is opened and whenever you tap the location button — to centre the map and find nearby Providers. If that location is within the area the Platform serves, it is sent to our servers as part of the search request; it is used to answer that search and is not saved in our database or written to our servers’ operational logs, although, as with any request, our hosting provider may keep technical records of it (see “Third-Party Services”). If you decline the location permission, the map simply opens at a default area.
• Visitors who are not signed in: until you first sign in on a device, the app opens on a public list of Providers that you can browse and filter, including by area. This list does not ask for permission to use your location and does not access your device’s location. Our website also shows a public list of Providers that anyone can browse and filter, including by area, without an account. It does not ask for or access your location; to show the list, your browser requests it from our servers and loads the Providers’ photos from our image hosting provider (or, for some Providers, from Google).

We do not track your location in the background, build a location history, or use your location for any purpose other than the map, search, distance, time-zone and area features described above.

11. Cookies, Tokens and On-Device Storage

Neither the app nor our website sets cookies of its own; our website host, Cloudflare, may set a strictly necessary security cookie in your browser if its security features check a request. To keep you signed in and to operate the app, we use authentication tokens and on-device storage. Our website at collaro.app stores only two things in your browser’s local storage: the language you last chose with its language switch, which it uses to show its “page not found” page in that language, and the display settings you choose in its accessibility menu (such as text size or high contrast), which it uses to show its pages that way. Both stay in your browser and are not sent to us.

On your device, your sign-in tokens are stored in the operating system’s secure keystore.

We also store, in ordinary on-device storage, a per-installation device identifier, your preferences (such as language and display theme), your device’s push token, whether anyone has signed in to the app on this device (so that it then opens on the sign-in screen rather than the public list of Providers), the internal identifier of each account for which the notification-permission prompt has been completed on this device, any update prompt you postponed, on Android the folder you chose for saved documents, and a few display settings (for example, whether you have dismissed a notice). The device identifier is generated on your device, is used to keep one active session per device, and is not a hardware identifier or advertising identifier. In addition, documents you generate (such as booking summaries and payment-record spreadsheets) and photos you pick in the app — including identity-verification images — are written to the app’s temporary cache folder, where they can remain until your device’s system clears it. Signing out removes your sign-in tokens from the device and asks our servers to end that device’s sign-in and remove its push registration; if that request does not reach us (for example, when the device is offline), and when you are signed out because you deactivated your account, the device may remain registered for push notifications (see “Notifications and Communications”). Signing out does not remove this other locally stored information; clearing the app’s storage or uninstalling the app removes it from your device. Files you choose to export or save remain where you saved them until you delete them.

12. Notifications and Communications

We send two kinds of messages. Emails are sent for things you may need a record of, and cannot be switched off while you have an account: your verification, password-reset, account-restoration and Sign in with Apple connection codes, and a security notice when Sign in with Apple is connected to your existing account; the booking-completed notice sent to both parties when a booking ends; messages from our support team (the full text of support-conversation messages may be delivered to you by email, and the messages you send in a support conversation are delivered to our support team by email); and, for Providers, notices when we block or unblock your account (including the reason given). Push notifications carry your day-to-day activity: booking requests and their acceptance, rejection or expiry, cancellations and cancellation requests, payment confirmations, new reviews and new chat messages. Push notifications are optional, and you can turn them on or off with a single switch in Settings. Apart from the booking-completed notice, which is also emailed, these updates are delivered by push only, so turning push off (or declining the permission) means you will not be notified of them outside the app — they remain visible in the app at any time. There is currently no separate per-category control, and we do not send marketing or promotional notifications.

Push notifications are sent to every device registered to your account. A device whose sign-in ended without you signing out on it — for example, after you reset your password or after a long period without use — may continue to receive your account’s push notifications until someone signs in on it again or the app is removed from it. If you no longer have such a device, turn push notifications off with the switch in Settings: this stops push notifications to all of your devices until you turn them back on. No notifications are sent while your account is deactivated, but restoring it resumes them on the devices that were registered to it, including devices that were signed out when you deactivated it.

Push notifications may include limited details, such as a counterpart’s account name, a booking date or a star rating; they never include your verification codes or the content of chat messages. Depending on your device settings, the content of a notification may be shown on your lock screen.

13. Data Storage, Hosting and International Transfers

Your information is stored in our database (MongoDB) and, for images, with our image hosting provider (Cloudinary); our servers are hosted by Render, and short-lived operational data is kept in a Redis data store (see “Third-Party Services”). These providers, and the others listed there — such as OpenAI, Resend, Expo, Cloudflare (and, until our website’s move to it is complete, GitHub) and the map and geocoding services — may store or process information outside Israel, including in the United States, the European Union and the United Kingdom, and in other countries where they or their own service providers operate. Using the Platform therefore involves transferring your personal information outside Israel.

Each of these providers processes the information under its own terms and policies, and several of them offer data-processing terms in which they commit to protect it and to use it only to provide their services. The public OpenStreetMap-based geocoding services and the code-delivery network (unpkg) are used without any agreement with us.

14. How We Protect Your Information

We apply technical and organisational measures designed to protect your information, including: storing passwords only as one-way bcrypt hashes; storing verification codes and session refresh tokens only in hashed form; short-lived access tokens with rotating, revocable refresh sessions; authentication, role and ownership checks on access to data; rate limiting and security headers; limits on upload size and type; and configuration checks that prevent the production service from starting with insecure secrets. Our rate limiting briefly processes your IP address and, for some actions, your account identifier or email address, in counters that expire automatically within an hour. In our production environment, connections between the app and our servers are protected with transport encryption (HTTPS/TLS).

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. As noted above, uploaded images are served from public links. You are responsible for keeping your password and device secure and for activity that occurs under your account.

15. Account Deletion and Data Retention

Deactivating your account in the app. Once your account is set up, you can deactivate it at any time from Settings, using “Deactivate account” (if you started signing up but did not finish, see below). Deactivating is not deletion: it hides your account and signs you out, but keeps your account and your data so that you can restore them, and the app has no option that deletes your account. To have your account and personal information deleted, send us a deletion request as described below. To protect commitments in progress, deactivation is not available while any of your bookings is accepted and not yet concluded — cancelling an accepted booking normally requires the other party’s approval, so please wait for those bookings to complete, or cancel them by mutual agreement, first. When you deactivate your account, any pending booking requests that have not yet been accepted are automatically cancelled, any open payment-confirmation request you are involved in is closed, and you are signed out on all your devices.

What deactivation keeps. When you deactivate your account, we keep your data — including your name and email address, your dogs and their photos, your provider profile and its images, your services, your identity-verification record, your profile photo, your reviews, your messages and your devices’ push tokens — so that the account can be restored later. While your account is deactivated, it cannot sign in or act normally, it receives no notifications (other than an account-restoration code you request), and your profile, dogs and services are not shown to other users. Records that also belong to someone else remain available to them without your name: on a past booking, its booking summary or a previous conversation you are shown as a generic user under the label “Deleted user”, and reviews you wrote remain public on the Provider’s profile, attributed to “Deleted user”, and continue to count towards the Provider’s rating. If you are an Owner, your dogs’ names, notes, medical notes and photos are no longer shown to the Provider in the app. Some details do remain visible to the other party, however: notes you wrote on a booking, reasons you gave for a cancellation request, your dogs’ breed, age, size, gender and declared health status, and your account’s internal identifier. Image links the other party already received may keep working; a report about a Provider continues to show the Owner who filed it the Provider’s name as recorded when it was filed; and, as explained in “How Information Is Shared and What Other Users See”, reviews you wrote remain linked to one another and your profile photo may still be found.

Restoring your account. To restore your account, sign in with your existing credentials and verify a one-time code we email to your account address; verifying it re-activates the account with your data intact, and your account’s push notifications resume on the devices that were registered to it (see “Notifications and Communications”). If you no longer know your password, contact us at contact@collaro.app and we will help you restore the account. We do not delete deactivated accounts automatically: a deactivated account and its data are kept until you restore the account or we process a deletion request from you.

Requesting deletion of your account and personal information. The app does not let you delete your account or your personal information yourself; they are deleted by our team, at your request. To ask for this, send us a deletion request through the Contact us form in the app: open the side menu, tap “Contact us”, choose “Account issue” as the reason and write that you want your account and personal information deleted. The form tells us which account the request comes from, so you do not need to identify it yourself. The form is available only while you are signed in to an active account: if you have already deactivated your account, did not finish signing up (for example, you did not verify your email address or did not choose a role), or can no longer sign in, email your request instead to contact@collaro.app from the email address of the account concerned. If you signed in with Apple using Hide My Email, the address on your account is the private relay address Apple created, so if you email us, tell us that address (it is shown in your Apple ID settings) so that we can identify your account. Our team reviews each deletion request and processes it manually, so deletion is not automatic or immediate. We may need to verify your identity first. We will confirm that we have received your request and, once we have processed it, tell you what we have deleted and whether we have kept any of your information, and why. A deletion request does not remove every record that relates to you: the records described in the next paragraph are kept; copies may remain for a limited period in backups, in our servers’ operational logs and with our service providers under their own retention periods (for example, emails kept by our email-delivery provider, and identity-verification images kept by OpenAI); and our correspondence with you, including your request, may remain in our support mailbox. Neither deactivating your account nor a deletion request disconnects Collaro from your Apple ID: you can stop using Sign in with Apple with Collaro at any time in your Apple ID settings. You can ask us for a copy of your personal information in the same way.

What we keep. Some records describe something that happened between you and another user, and are that person’s record as much as yours. To keep other users’ records complete and consistent, we keep — including after we have processed a deletion request — past bookings — including requests that were declined, expired or cancelled, with the copy of the dogs’ profiles they hold — and their booking summaries, reviews you wrote, messages you sent (which remain in the other person’s conversation), and reports you filed or that concern you, together with their evidence; to other users you appear in them as a generic user under the label “Deleted user”, subject to the details described above that remain visible. We also keep our internal audit record of booking- and account-related events, which refers to accounts by internal identifiers and can include amounts, statuses and, for a Provider block, the reason given, and, where the law requires us to keep information, or where a dispute, a report, a suspected fraud or abuse, or a legal claim concerning you is pending, we keep the information needed for that purpose until the obligation ends or the matter is resolved.

Retention generally. While your account is active, we retain your information for as long as needed to provide the Platform. Content you delete in the app — such as a dog, a service or a gallery image — is deleted from our database when you delete it, except for the copies kept in bookings and reports and the photos described in “How Uploaded Images Are Handled” (copies may remain for a limited period in backups). For other records we have not set fixed retention periods: unless this Policy says otherwise, they are kept until we process a deletion request from you, and the records described under “What we keep” are kept even then. Some information is deleted automatically: one-time codes expire 10 minutes after they are issued; rate-limiting counters expire within an hour; cached address and place lookups expire after five minutes; and a sign-in record is deleted when it expires, a set period after it was last used (by default, 90 days), including the records of devices that have signed out. Our servers’ operational logs are kept for a limited period set by our hosting provider. An account whose sign-up was never finished is kept until you ask us to delete it.

16. Your Privacy Rights

Under Israeli law, you have the right to inspect the personal information about you that is kept in our database — yourself, through a representative you have authorised in writing, or through your guardian — and, if you find that it is not correct, complete, clear or up to date, to ask us to correct or delete it. If we refuse a request to inspect or to correct information, we will tell you, and you may appeal to the court as the law provides. Depending on where you live, other laws may give you additional rights.

You can make many choices directly in the app — for example by editing your profile, dogs and other content, by turning location access off in your device settings, by turning push notifications off with the switch in the app’s Settings, or by deactivating your account in Settings (which does not delete it). To inspect your information, receive a copy of it, have it corrected, have your account and personal information deleted, withdraw a consent you gave (for example, for identity verification), or for any other request, contact us through the Contact us form in the app (while you are signed in to an active account) or at contact@collaro.app; deletion requests are reviewed and processed manually, as described in “Account Deletion and Data Retention”. We may need to verify your identity before acting on a request, and we will respond within the time required by law; for a request to inspect your information, we will let you inspect it, or tell you that we refuse, within 30 days of receiving the request. Withdrawing a consent stops the processing that relies on it from then on; it does not affect processing already carried out, or the information we keep as described in “Account Deletion and Data Retention” (including copies held by our service providers under their own retention periods). You also have the right to lodge a complaint with the Privacy Protection Authority in Israel or, where the law of the place you live gives you that right, with your local data-protection authority.

17. Legal Basis for Processing

Under Israeli law, we process your personal information on the basis of your consent and, where applicable, of a legal obligation or authorisation:

• Consent: you consent to the processing described in this Policy when you accept it — if you register with an email address and password, before your account is created; if you continue with Google or Apple, on the screen shown after your first sign-in, before you choose your role. Until then, we process only the basic account, sign-in and device information described in “Information We Collect”, to create the account and show you that screen. You also give specific consent when you choose to use particular features — for example, when you allow the app to use your device location or to send you notifications, when you publish a Provider profile, or when you submit identity-verification images. Some processing is necessary to provide a feature you choose; if you do not consent to it, you cannot use that feature (see “Information We Collect”). You may withdraw a consent at any time — for example, by turning off location access in your device settings, by turning push notifications off with the switch in the app’s Settings, by pausing all your services (for a Provider profile), or by contacting us — without affecting processing already carried out. Turning notifications off only in your device settings stops them from being shown on that device, but our servers keep sending them to our push-delivery providers until you also turn them off with the switch in the app’s Settings (if they are already off in your device settings, turn them back on there first) or ask us to.
• Visitors without an account: when you browse the public list of Providers in the app or on our website, we process technical information about your requests, such as your IP address, to show you the list and to protect our servers (for example, by rate limiting), and the service providers described in “Third-Party Services” receive it as described there.
• Legal obligations and authorisations: we may process information where the law requires or authorises us to do so — for example, to comply with record-keeping duties and lawful requests.
• If the European Union’s General Data Protection Regulation (GDPR) or the UK GDPR applies to you, we rely on: performance of a contract, to provide the Platform and carry out the bookings you request; your consent, for location access, notifications and identity verification (for identity verification, the consent you give on the verification screen); our legitimate interests, to keep the Platform safe and secure, prevent fraud and abuse, and moderate reports, balanced against your rights; and legal obligation. You also have the rights to have your personal data erased, to restrict its processing, to receive it in a portable format, and to object at any time to processing based on our legitimate interests, and you may complain to the supervisory authority where you live. Transfers outside Israel are described in “Data Storage, Hosting and International Transfers”.

18. Children’s Privacy

You must be at least 13 years old to create an account or use the Platform. If you are under 18, you may use the Platform only with the consent of your parent or legal guardian (see “Eligibility” in the Terms of Service). The app does not ask for or check your age or your parent’s or guardian’s consent; it is up to you, and to your parent or guardian, to make sure these conditions are met. If you are under 18 and register as a Provider, remember that your phone number, street address and exact location become public (see “How Information Is Shared and What Other Users See”). We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, or you are the parent or guardian of a minor who uses the Platform and want to review or remove their information, please contact us at contact@collaro.app.

19. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to the Platform or to legal requirements. When we make a material change — in particular, one that changes what personal information we collect, how we use it or with whom we share it — we will update the version and the “Last updated” date above and ask you in the app to review and accept the updated Policy; you will need to accept it to keep using your account. The app asks you the next time you use a version of it that includes the update, and we may require you to update an older version of the app first. Other changes (limited to clarifications and corrections that do not change the meaning of this Policy, and changes required by law) take effect from the “Last updated” date shown above; any other change is made as a material change. If you do not agree to an updated version, you can decline it from the screen that asks you to accept it, as described in section 23 of the Terms of Service: once declining is complete, you are signed out on the device where you declined, and you cannot use the app on any device until you accept it (push notifications may still reach other devices registered to your account — see “Notifications and Communications”). Your account and the information in it are kept — declining does not delete them. You can also stop using the Platform and ask us by email at contact@collaro.app to close your account or delete your personal information, as described in “Account Deletion and Data Retention”.

20. Contact Us

If you have questions, concerns or requests regarding this Privacy Policy or your personal information, you can contact us at:

• Operator: Collaro, operated by Ofek Levi (the controller of your personal information)
• Privacy: contact@collaro.app
• Support: contact@collaro.app
• In the app: the Contact us form in the side menu (while you are signed in to an active account)
• Postal address: Israel, Rosh HaAyin, Yoram Hatuka 36

We will do our best to resolve any concern you raise.